CVE-2026-20685 is a path traversal vulnerability affecting Apple’s Private Cloud Compute (PCC), potentially allowing attackers to write files as root during node boot and redirect sensitive AI inference telemetry to an external server.

Sentry Security researcher Drinor received a $150,000 Apple Security Bounty for discovering and reporting CVE-2026-20685, a flaw that could expose sensitive data and allow unauthorized access.

PCC is Apple’s server-side platform for Apple Intelligence requests that are too complex to run entirely on an iPhone, iPad, or Mac. Apple describes the system as an extension of device-level privacy protections into the cloud.

Its design relies on stateless request processing, cryptographic attestation of approved software, and tightly controlled logging systems.

The flaw was found in darwin-init, the first userspace process launched on a PCC node. Running as PID 1 with root privileges, darwin-init downloads, extracts, personalizes, and installs cryptex packages before triggering a userspace reboot into the normal operating environment.

Apple Private Cloud Compute Vulnerability

According to the Sentry Security research, darwin-init selected an archive extractor by examining only the first 4 bytes of an incoming file. A malicious tar archive did not match known Apple archive signatures and was passed to a generic extraction function.

That function appended archive entry names to the intended output path without properly validating path traversal sequences such as ../../../../.

As a result, a crafted archive could escape its extraction folder and write attacker-controlled files to persistent locations on the PCC node’s writable data volume, including /var/db/.

Because darwin-init runs as root before steady-state security services load, those files could remain available after the userspace reboot.
The researcher built a malicious archive that contained both traversal entries and a structurally valid cryptex bundle.

This was important because an invalid cryptex installation would prevent the system from completing its boot process. By combining a legitimate-looking bundle with malicious file paths, the archive could pass installation checks while placing files outside the intended extraction directory.

One demonstrated impact involved PCC’s internal splunkloggingd service. The service checks for a configuration file on the writable data volume and starts when that file exists.

By using the root file write to create a malicious logging configuration, the researcher redirected PCC telemetry to a controlled endpoint.

The redirected data reportedly included CloudBoard daemon activity, node events, and metadata associated with AI inference requests.

During test inference activity in Apple’s Virtual Research Environment, the logs exposed values such as application bundle identifiers, workload types, request identifiers, device-grouping metadata, token counts, output-token metrics, and latency measurements.

These details could reveal information about how a PCC node processes AI requests. For example, input token counts corresponded to prompt length.

At the same time, other values exposed first-token latency, speculative decoding information, and model-related telemetry. Apple’s source code reportedly identifies some of the affected metadata as information that should not be logged publicly.

The Sentry Security research also found an attestation gap. Apple’s PCC attestation process appeared to confirm that approved software and cryptotex components were installed.

However, it did not measure writable data volume files that could influence daemon behavior at runtime. A modified node could therefore appear identical to a clean node during software attestation checks.

Apple classified CVE-2026-20685 as an information disclosure issue with a CVSS score of 6.5. The company fixed the vulnerability in PCC releases 5E290.3 and later. The testing was conducted solely in Apple’s official Virtual Research Environment, with no production PCC infrastructure involved.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.